Message of another user could be deleted #1441

Admidio · Jun 15, 2023 · 3b248b7 · 3b248b7
1 parent f20c8ec
commit 3b248b7
Showing 1 changed file with 10 additions and 7 deletions.
diff --git a/adm_program/modules/messages/messages.php b/adm_program/modules/messages/messages.php
@@ -38,14 +38,17 @@
     $delMessage = new TableMessage($gDb);
     $delMessage->readDataByUuid($getMsgUuid);
 
-    // Function to delete message
-    $returnCode = $delMessage->delete();
-
-    if ($returnCode) {
-        echo 'done';
-    } else {
-        echo 'delete not OK';
+    // only delete messages of the current user is allowed
+    if ($delMessage->getValue('msg_usr_id_sender') === $gCurrentUserId) {
+        $returnCode = $delMessage->delete();
+
+        if ($returnCode) {
+            echo 'done';
+            exit();
+        }
     }
+
+    echo 'delete not OK';
     exit();
 }